#!/bin/sh /etc/rc.common

START=99
STOP=10
USE_PROCD=1

PROG=/usr/bin/hubvpn
CONF=hubvpn
CONFIG_DIR=/etc/hubvpn
DEFAULT_PASSWORD_FILE=$CONFIG_DIR/password
LOG_FILE=/var/log/hubvpn.log
BRIDGE_UDP_PORT=20000

start_service() {
    local enabled mode tag vip server control_wss username password password_file
    local web_port web_lan_access web_password proxy_allow_private debug

    config_load "$CONF"
    config_get_bool enabled config enabled 0
    [ "$enabled" -eq 1 ] || return 0

    config_get mode config mode 'bridge'
    config_get tag config tag 'iStoreOS'
    config_get vip config vip '10.10.0.1'
    config_get server config server '23.226.135.135:9999'
    config_get control_wss config control_wss 'wss://yeeid.com/hubvpn-ws/'
    config_get username config username 'admin@qq.com'
    config_get password config password ''
    config_get password_file config password_file "$DEFAULT_PASSWORD_FILE"
    config_get web_port config web_port '16699'
    config_get_bool web_lan_access config web_lan_access 1
    config_get web_password config web_password ''
    config_get_bool proxy_allow_private config proxy_allow_private 1
    config_get_bool debug config debug 0

    [ -x "$PROG" ] || {
        logger -t hubvpn "Error: executable $PROG not found or not executable"
        return 1
    }

    mkdir -p "$CONFIG_DIR"
    chmod 0700 "$CONFIG_DIR"

    # 若 Web 端在 UCI 填写了新密码，安全写入 0600 密钥文件，并立即清空 UCI 明文防泄露
    if [ -n "$password" ]; then
        printf '%s' "$password" > "$password_file"
        chmod 0600 "$password_file"
        uci -q set hubvpn.config.password=''
        uci -q commit hubvpn
    fi

    # 停止/重启防碰撞守卫：等待 UDP 端口彻底释放
    if command -v netstat >/dev/null 2>&1; then
        i=0
        while netstat -uln 2>/dev/null | grep -q ":$BRIDGE_UDP_PORT "; do
            if [ "$i" -ge 10 ]; then
                logger -t hubvpn "UDP $BRIDGE_UDP_PORT still bound after 10s, aborting start"
                return 1
            fi
            i=$((i+1))
            sleep 1
        done
    fi

    local ARGS="-cli -mode $mode -server $server -tag $tag -vip $vip -u $username"
    [ -n "$control_wss" ] && ARGS="$ARGS -control-wss $control_wss"
    [ "$proxy_allow_private" -eq 1 ] && ARGS="$ARGS -proxy-allow-private"
    [ -n "$web_password" ] && ARGS="$ARGS -webpass $web_password"
    [ "$web_lan_access" -eq 1 ] && ARGS="$ARGS -web-lan-access"

    procd_open_instance hubvpn
    procd_set_param command /bin/sh -c "exec $PROG $ARGS >>$LOG_FILE 2>&1"
    procd_set_param env HUBVPN_PASSWORD_FILE="$password_file"
    procd_append_param env HUBVPN_WEB_ALLOW_EMBED="1"
    [ "$web_lan_access" -eq 1 ] && procd_append_param env HUBVPN_WEB_LAN_ACCESS="1"
    [ -z "$web_password" ] && [ "$web_lan_access" -eq 1 ] && procd_append_param env HUBVPN_WEB_INSECURE_LAN="1"
    [ "$debug" -eq 1 ] && procd_append_param env MY_DEBUG="1"
    procd_set_param respawn 3600 5 0
    procd_set_param stdout 1
    procd_set_param stderr 1
    procd_close_instance
}

service_triggers() {
    procd_add_reload_trigger "hubvpn"
}

reload_service() {
    stop
    start
}

stop_service() {
    procd_kill hubvpn hubvpn
    if command -v netstat >/dev/null 2>&1; then
        i=0
        while netstat -uln 2>/dev/null | grep -q ":$BRIDGE_UDP_PORT "; do
            if [ "$i" -ge 15 ]; then
                logger -t hubvpn "stop: UDP $BRIDGE_UDP_PORT still bound after 15s"
                break
            fi
            i=$((i+1))
            sleep 1
        done
    fi
}
